Release v610

.github/workflows/apt.yml

@@ -327,7 +327,7 @@ jobs:
         run: ./fluent-package/test-tools/setup-incus.sh
       - name: Setup Elasticsearch on host
         run: |
-          docker run -d -p 9200:9200 -e "discovery.type=single-node" -e "xpack.security.enabled=false" docker.elastic.co/elasticsearch/elasticsearch:8.19.11
+          docker run -d -p 9200:9200 -e "discovery.type=single-node" -e "xpack.security.enabled=false" docker.elastic.co/elasticsearch/elasticsearch:9.5.2
       - name: Copy elasticsearch.conf
         run: cp fluent-package/test-tools/elasticsearch.conf fluent-package/apt/systemd-test
       - name: Ensure elasticsearch availability from host
@@ -356,7 +356,7 @@ jobs:
       - name: Setup Opensearch on host
         run: |
           docker run -d -p 9200:9200 -p 9600:9600 \
-            -e "discovery.type=single-node" -e OPENSEARCH_INITIAL_ADMIN_PASSWORD=Passvv0rd@ opensearchproject/opensearch:2
+            -e "discovery.type=single-node" -e OPENSEARCH_INITIAL_ADMIN_PASSWORD=Passvv0rd@ opensearchproject/opensearch:3
       - name: Copy opensearch.conf
         run: cp fluent-package/test-tools/opensearch.conf fluent-package/apt/systemd-test
       - name: Ensure Opensearch availability from host

.github/workflows/maintenance-bundle-update.yml

@@ -23,8 +23,8 @@ jobs:
           CMAKE_POLICY_VERSION_MINIMUM: "3.5"
         run: |
           cd fluent-package
-          gem install bundler:2.7.2
-          bundle _2.7.2_ update -j 4
+          gem install bundler:4.0.20
+          bundle _4.0.20_ update -j 4
       - name: Create Pull Request
         run: |
           $today=Get-Date -Format "yyyy-MM-dd-HHmmss"

.github/workflows/retry-workflows.yml

@@ -10,6 +10,7 @@ on:
       - Yum based Linux
       - Yum based Linux (AArch64)
       - Windows
+      - Windows (ARM64)
     types:
       - completed
 

.github/workflows/windows-arm.yml

@@ -0,0 +1,101 @@
+name: Windows (ARM64)
+on:
+  push:
+    branches:
+      - master
+  pull_request:
+  workflow_dispatch:
+concurrency:
+  group: ${{ github.head_ref || github.sha }}-${{ github.workflow }}
+  cancel-in-progress: true
+jobs:
+  build:
+    name: Build
+    timeout-minutes: 90
+    runs-on: windows-11-arm
+    steps:
+      - name: Set up Ruby
+        uses: ruby/setup-ruby@14594264cd68ce8a2345dd349bc3d138a4ef85c8 # v1.327.0
+        with:
+          ruby-version: 3.4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: cache msi
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        id: cache-msi
+        with:
+          path: fluent-package/msi/repositories
+          key: ${{ runner.os }}-${{ runner.arch }}-cache-windows-${{ hashFiles('**/config.rb', '**/Rakefile', '**/Gemfile*', 'fluent-package/msi/assets/*', 'fluent-package/msi/source.wxs', 'fluent-package/msi/parameters.wxi.erb', 'fluent-package/msi/localization-en-us.wxl', 'fluent-package/msi/exclude-files.xslt', '.github/workflows/windows-arm.yml') }}
+      - name: Install WiX Toolset
+        if: ${{ ! steps.cache-msi.outputs.cache-hit }}
+        shell: pwsh
+        run: |
+          $zip = "$env:RUNNER_TEMP\wix314-binaries.zip"
+          Invoke-WebRequest -Uri https://github.com/wixtoolset/wix3/releases/download/wix3141rtm/wix314-binaries.zip -OutFile $zip
+          $hash = (Get-FileHash -Algorithm SHA256 $zip).Hash
+          if ($hash -ne "6AC824E1642D6F7277D0ED7EA09411A508F6116BA6FAE0AA5F2C7DAA2FF43D31") {
+            throw "Unexpected SHA256 of wix314-binaries.zip: $hash"
+          }
+          Expand-Archive -Path $zip -DestinationPath "$env:RUNNER_TEMP\wix\bin"
+          "WIX=$env:RUNNER_TEMP\wix" | Out-File -FilePath $env:GITHUB_ENV -Append
+      - name: Build
+        if: ${{ ! steps.cache-msi.outputs.cache-hit }}
+        shell: pwsh
+        working-directory: fluent-package
+        run: |
+          $env:MSYS2_PATH = ruby -e "require 'ruby_installer/runtime'; puts RubyInstaller::Runtime.msys2_installation.msys_path"
+          $env:FLUENT_PACKAGE_STAGING_PATH = "C:/opt/fluent"
+          $env:FLUENT_PACKAGE_MSI_OUTPUT_PATH = "$PWD/msi/repositories"
+          gem install bundler:4.0.20 --no-document
+          rake msi:selfbuild
+      - name: Upload msi
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: packages-windows-arm64
+          path: fluent-package/msi/repositories
+  check_package_size:
+    name: Check Package Size
+    needs: build
+    runs-on: windows-11-arm
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: packages-windows-arm64
+          path: fluent-package/msi/repositories
+      - name: Check Package Size
+        shell: pwsh
+        run: |
+          powershell -ExecutionPolicy Bypass -Command ".\fluent-package\msi\pkgsize-test.ps1"
+  test:
+    name: Test ${{ matrix.test }}
+    needs: build
+    runs-on: windows-11-arm
+    strategy:
+      fail-fast: false
+      matrix:
+        test:
+          - "install-test.ps1"
+          - "install-test-with-install-path-including-space.ps1"
+          - "update-from-v4-test.ps1"
+          - "update-from-v4-test.ps1 -ViaV5"
+          - "update-from-v5-test.ps1"
+          - "serverspec-test.ps1"
+          - "load-extensions-test.ps1"
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: packages-windows-arm64
+          path: fluent-package/msi/repositories
+      - name: Hide MSYS2
+        shell: pwsh
+        run: |
+          if (Test-Path C:\msys64) {
+            Rename-Item C:\msys64 C:\msys64-hidden
+          }
+      # The test scripts expect the repository in C:\fluentd as in the Docker container for x86_64.
+      - name: Installation Test
+        shell: pwsh
+        run: |
+          New-Item -ItemType Junction -Path C:\fluentd -Target $PWD | Out-Null
+          powershell -ExecutionPolicy Bypass -Command "C:\fluentd\fluent-package\msi\${{ matrix.test }}"

.github/workflows/windows.yml

@@ -47,7 +47,7 @@ jobs:
         if: ${{ ! steps.cache-msi.outputs.cache-hit }}
         run: |
           gem install serverspec
-          gem install bundler:2.7.2 --no-document
+          gem install bundler:4.0.20 --no-document
           rake msi:build
       - name: Upload td-agent msi
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
@@ -82,6 +82,7 @@ jobs:
           - "update-from-v4-test.ps1 -ViaV5"
           - "update-from-v5-test.ps1"
           - "serverspec-test.ps1"
+          - "load-extensions-test.ps1"
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1

.github/workflows/yum.yml

@@ -403,7 +403,7 @@ jobs:
         run: ./fluent-package/test-tools/setup-incus.sh
       - name: Setup Elasticsearch on host
         run: |
-          docker run -d -p 9200:9200 -e "discovery.type=single-node" -e "xpack.security.enabled=false" docker.elastic.co/elasticsearch/elasticsearch:8.19.11
+          docker run -d -p 9200:9200 -e "discovery.type=single-node" -e "xpack.security.enabled=false" docker.elastic.co/elasticsearch/elasticsearch:9.5.2
       - name: Copy elasticsearch.conf
         run: cp fluent-package/test-tools/elasticsearch.conf fluent-package/yum/systemd-test
       - name: Ensure elasticsearch availability from host
@@ -432,7 +432,7 @@ jobs:
       - name: Setup Opensearch on host
         run: |
           docker run -d -p 9200:9200 -p 9600:9600 \
-            -e "discovery.type=single-node" -e OPENSEARCH_INITIAL_ADMIN_PASSWORD=Passvv0rd@ opensearchproject/opensearch:2
+            -e "discovery.type=single-node" -e OPENSEARCH_INITIAL_ADMIN_PASSWORD=Passvv0rd@ opensearchproject/opensearch:3
       - name: Copy opensearch.conf
         run: cp fluent-package/test-tools/opensearch.conf fluent-package/yum/systemd-test
       - name: Ensure Opensearch availability from host

CHANGELOG.md

@@ -2,6 +2,75 @@
 
 About the past changelog entries, see [CHANGELOG v4](CHANGELOG-v4.md) [CHANGELOG v5](CHANGELOG-v5.md) instead.
 
+## Release v6.1.0 - 2026/10/29
+
+### News
+
+* Update bundled Fluentd to v1.20.1
+* Update bundled gems
+* Changed to keep compatibility with older RHEL 9.x/10.x (#1087, #1088)
+* msi: fix broken link to enterprise services (#1078)
+* Drop LTO flags on RHEL 10.x and Ubuntu. Note that hardening flags are kept. (#1101)
+* msi: add a package for ARM64 Windows (PR #1132)
+* msi: stop bundling nokogiri. The winevt_xml parser uses REXML instead, and in_windows_eventlog2 checks bookmarks less strictly. Install nokogiri with `fluent-gem install nokogiri` to keep the previous behavior or to use `parser nokogiri`. (PR #1132)
+
+### Core component
+
+* ruby v3.4.12 (update)
+* jemalloc v5.3.1 (update)
+* OpenSSL 3.6.3 Windows (update)
+* OpenSSL 3.0.8 macOS
+* gems
+  * fluentd v1.20.0 (update)
+  * msgpack 1.8.5 (update)
+  * oj 3.17.7 (update)
+  * webrick 1.9.2
+  * openssl 4.0.2 (update)
+
+### Bundled plugins and gems
+
+* aws-partitions v1.1298.0 (update)
+* aws-sdk-core v3.260.0 (update)
+* aws-sdk-kms v1.135.0 (update)
+* aws-sdk-s3 v1.235.0 (update)
+* aws-sdk-sqs v1.122.0 (update)
+* aws-sigv4 v1.12.1
+* elasticsearch v9.5.0 (update)
+* fluent-diagtool v1.0.5
+* fluent-plugin-elasticsearch v6.0.0
+* fluent-plugin-flowcounter-simple 0.1.0
+* fluent-plugin-kafka v0.19.8 (update)
+* fluent-plugin-metrics-cmetrics v0.1.2
+* fluent-plugin-fluent-package-update-notifier 0.2.4 (update)
+* fluent-plugin-obsolete-plugins v0.2.2
+* fluent-plugin-opensearch v1.1.8 (update)
+* fluent-plugin-opentelemetry 0.5.4 (update)
+* fluent-plugin-prometheus v2.3.0 (update)
+* fluent-plugin-prometheus_pushgateway v0.2.1
+* fluent-plugin-record-modifier v2.2.1
+* fluent-plugin-rewrite-tag-filter v2.4.1 (update)
+* fluent-plugin-s3 v1.8.6 (update)
+* fluent-plugin-sigdump v1.0.1 (new)
+* fluent-plugin-sd-dns 0.1.0
+* fluent-plugin-systemd v1.1.2 (update)
+* fluent-plugin-td v1.2.0
+* fluent-plugin-utmpx v0.5.0
+* fluent-plugin-webhdfs v1.6.0
+* mini_portile2 v2.8.9
+* prometheus-client v5.0.0 (update)
+* rdkafka v0.21.0
+* ruby-kafka v1.5.0
+* systemd-journal v2.1.1
+* td-client v3.0.1 (update)
+* webhdfs v0.11.0
+
+On Windows
+
+* fluent-plugin-parser-winevt_xml v0.3.1 (update)
+* fluent-plugin-windows-eventlog v0.9.3 (update)
+* fluent-plugin-windows-exporter v1.0.0
+* winevt_c v0.11.6 (update)
+
 ## Release v6.0.5 - 2026/09/29
 
 ### News

fluent-package/Gemfile

@@ -15,21 +15,21 @@ source "https://rubygems.org"
 no_fat_gem = [:ruby]
 gem "rake"
 gem "bundler", BUNDLER_VERSION
-gem "cool.io", "1.9.0",  platforms: no_fat_gem
+gem "cool.io", "1.10.1",  platforms: no_fat_gem
 gem "sigdump", "0.2.5"
-gem "http_parser.rb", "0.8.0"
+gem "http_parser.rb", "0.8.1"
 gem "yajl-ruby", "1.4.3"
 gem "serverengine", "2.4.0"
-gem "msgpack", "1.8.0"
-gem "oj", "3.16.11"
+gem "msgpack", "1.8.5"
+gem "oj", "3.17.7"
 gem "tzinfo", "2.0.6"
-gem "tzinfo-data", "1.2025.2"
+gem "tzinfo-data", "1.2026.5"
 
 # Fluentd v1.19.0 requires io-event 1.10.x or before.
 # The dependency condition cannot be met with async >= 2.25
-gem "async", "2.24.0"
-gem "async-http", "0.89.0"
-gem "webrick", "1.9.1"
+gem "async", "2.46.0"
+gem "async-http", "0.105.0"
+gem "webrick", "1.9.2"
 
 if ENV["INSTALL_GEM_FROM_LOCAL_REPO"]
   # During build process, pre-built fluentd gem will be installed
@@ -44,77 +44,84 @@ if ENV["INSTALL_GEM_FROM_LOCAL_REPO"]
     # https://github.com/fluent/fluent-package-builder/issues/618
     # NOTE: platforms: does not work in source ... do block
     gem "win32-service" if RUBY_PLATFORM =~ /mswin|mingw/
+    # Bundle forked version of ffi-win32-extensions until
+    # ffi 1.17.1 or later is supported.
+    # This workaround should be applied to fluent-package not to block using
+    # newer rdkafka to fix SEGV issue.
+    # https://github.com/fluent/fluent-package-builder/issues/1051
+    gem "ffi-win32-extensions" if RUBY_PLATFORM =~ /mswin|mingw/
   end
 else
   # Lock to specific revision
   git_source(:github) {|repo_name| "https://github.com/#{repo_name}" }
   gem "fluentd", github: "fluent/fluentd", ref: FLUENTD_REVISION
   gem "win32-service", github: "fluent-plugins-nursery/win32-service", branch: "fluent-package", platforms: [:mingw, :x64_mingw]
+  gem "ffi-win32-extensions", github: "fluent-plugins-nursery/ffi-win32-extensions", branch: "fluent-package", platforms: [:mingw, :x64_mingw]
 end
 
 # plugin gems
 
-gem "elasticsearch", "8.19.0"
+gem "elasticsearch", "9.5.0"
 gem "fluent-plugin-elasticsearch", "6.0.0"
 gem "ruby-kafka", "1.5.0"
 gem "digest-murmurhash", "1.1.1"
-gem "fluent-plugin-kafka", "0.19.5"
-gem "prometheus-client", "4.2.5"
-gem "fluent-plugin-prometheus", "2.2.1"
+gem "fluent-plugin-kafka", "0.19.8"
+gem "prometheus-client", "5.0.0"
+gem "fluent-plugin-prometheus", "2.3.0"
 gem "fluent-plugin-prometheus_pushgateway", "0.2.1"
 gem "jmespath", "1.6.2"
-gem "aws-partitions", "1.1150.0"
-gem "aws-sdk-core", "3.230.0"
-gem "aws-sdk-kms", "1.110.0"
-gem "aws-sdk-sqs", "1.101.0"
+gem "aws-partitions", "1.1298.0"
+gem "aws-sdk-core", "3.260.0"
+gem "aws-sdk-kms", "1.135.0"
+gem "aws-sdk-sqs", "1.122.0"
 gem "aws-sigv4", "1.12.1"
-gem "aws-sdk-s3", "1.197.0"
-gem "fluent-plugin-s3", "1.8.3"
+gem "aws-sdk-s3", "1.235.0"
+gem "fluent-plugin-s3", "1.8.6"
 gem "httpclient", "2.9.0"
 gem "fluent-diagtool", "1.0.5"
-gem "td", "0.19.0"
-gem "td-client", "3.0.0"
+gem "td", "0.19.1"
+gem "td-client", "3.0.1"
 gem "fluent-plugin-td", "1.2.0"
 gem "webhdfs", "0.11.0"
 gem "fluent-plugin-webhdfs", "1.6.0"
 gem "fluent-plugin-record-modifier", "2.2.1"
-gem "fluent-plugin-rewrite-tag-filter", "2.4.0"
+gem "fluent-plugin-rewrite-tag-filter", "2.4.1"
 gem "fluent-plugin-sd-dns", "0.1.0"
 gem "fluent-plugin-flowcounter-simple", "0.1.0"
 gem "mini_portile2", "2.8.9"
 gem "cmetrics", "0.3.3"
 gem "fluent-plugin-metrics-cmetrics", "0.1.2"
 gem "opensearch-ruby", "3.4.0"
-gem "fluent-plugin-opensearch", "1.1.5"
-gem "fluent-plugin-fluent-package-update-notifier", "0.2.3"
+gem "fluent-plugin-opensearch", "1.1.8"
+gem "fluent-plugin-fluent-package-update-notifier", "0.2.4"
 gem "fluent-plugin-obsolete-plugins", "0.2.2"
-gem "fluent-plugin-opentelemetry", "0.3.0"
+gem "fluent-plugin-opentelemetry", "0.5.4"
 gem "fluent-plugin-sigdump", "1.0.1"
 
 windows_platforms = [:mingw, :x64_mingw] # :mswin
 # ffi-win32-extensions doesn't support ffi 1.17.1 or later
-gem "ffi", "1.17.0", platforms: windows_platforms
-gem "ffi-win32-extensions", "1.1.0", platforms: windows_platforms
+gem "ffi", "1.17.4", platforms: windows_platforms
+# Use officially released version when PR was merged and released.
+#gem "ffi-win32-extensions", "1.1.0", platforms: windows_platforms
 # fiddle gem that isn't default gems as of Ruby 3.5
 gem "fiddle", "1.1.8", platforms: windows_platforms
-gem "nokogiri", "1.18.9", platforms: windows_platforms
 gem "win32-event", "0.6.3", platforms: windows_platforms
 gem "win32-ipc", "0.7.0", platforms: windows_platforms
 # Use officially released version when PR was merged and released.
 #gem "win32-service", "2.3.2", platforms: windows_platforms
-gem "winevt_c", "0.11.2", platforms: windows_platforms
+gem "winevt_c", "0.11.6", platforms: windows_platforms
 gem "win32-eventlog", "0.6.7", platforms: windows_platforms
-gem "fluent-plugin-parser-winevt_xml", "0.2.8", platforms: windows_platforms
-gem "fluent-plugin-windows-eventlog", "0.9.1", platforms: windows_platforms
+gem "fluent-plugin-parser-winevt_xml", "0.3.1", platforms: windows_platforms
+gem "fluent-plugin-windows-eventlog", "0.9.3", platforms: windows_platforms
 gem "fluent-plugin-windows-exporter", "1.0.0", platforms: windows_platforms
 
 not_windows_platforms = [:ruby]
-gem "capng_c", "0.2.3", platforms: not_windows_platforms
+gem "capng_c", "0.2.5", platforms: not_windows_platforms
 # Use newer bundled rdkafka with librdkafka 2.8.0 to support AlmaLinux 10
 # (librdkafka 2.8.0 supports "OpenSSL without the ENGINE component")
 # librdkafka 2.8.0 can't be built on CentOS 7.
 unless platform_centos7?
   gem "rdkafka", "0.21.0", platforms: not_windows_platforms
 end
-gem "fluent-plugin-systemd", "1.1.1", platforms: not_windows_platforms
+gem "fluent-plugin-systemd", "1.1.2", platforms: not_windows_platforms
 gem "fluent-plugin-utmpx", "0.5.0", platforms: not_windows_platforms